Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/aeonfun/aeonnpx agentmods add skills/aeonfun/aeon/seo-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aeonfun/aeon/seo-audit)<a href="https://agentmods.dev/skills/aeonfun/aeon/seo-audit"><img src="https://agentmods.dev/badge/skills/aeonfun/aeon/seo-audit.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 85 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.05168 |
| Opus 5 | $0.00028 | $0.02584 |
| Sonnet 5 | $0.00011 | $0.01034 |
| Haiku 4.5 | $0.00006 | $0.00517 |
Grade A, and why
seo-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- seo-audit — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Today is ${today}.
${var} — the target sites, comma-separated (an origin, not a page:
https://www.example.com). Each site is audited whole and independently. A bare host getshttps://prepended. A path in${var}(…/docs) still works — its origin is what gets crawled.Empty
${var}→ there is nothing to audit. This skill has no built-in default site (it ships general-purpose). LogSEO_NO_TARGET, send no notification, and exit clean — a daily "set a target" ping would just get muted. Set the target once in the dashboard (the skill'svar) and it runs from the next tick.
What this does
Discovers every page a site publishes, audits all of them, compares the result
against the previous run, and reports. The heavy lifting (discovery, fetching,
parsing, checking) happens in scripts/seo-audit.mjs, which returns
machine-readable findings so you reason over facts instead of eyeballing HTML.
Discovery is sitemap-first: robots.txt → sitemap.xml (following sitemap
indexes), honouring the robots * Disallow rules, falling back to a one-hop
crawl of the homepage's internal links when a site has no sitemap. That is the
same list Google works from, so auditing it is auditing what actually ranks.
Auditing the whole site — not three sample templates — is what makes the cross-page checks possible: duplicate titles, duplicate meta descriptions, canonicals pointing away from their own page, and pages linked but missing from the sitemap. None of those are visible from inside a single page, and all of them are ways a site quietly loses search traffic.
This is on-page and technical SEO only — no keyword research, rank tracking, or backlink analysis. If a finding would need those, say so rather than guessing.
Capability notes (read before editing this skill)
This skill is mode: read-only, and that is load-bearing:
- The auditor is Node, not Python, because
Bash(node:*)is in the read-only capability base whileBash(python3:*)is write-tier only (scripts/skill_mode.sh). Porting it back to Python would forcemode: write. - It is dependency-free stdlib Node, matching every other helper in
scripts/. There is no install step. If you find yourself wanting a package, you are about to break the thing that makes this skill cheap and safe. - You have no Write or Edit tool. Every file this skill produces is written
with a shell redirection (
>/>>) from an allowed command. The workflow's read-only guard reverts writes to code/config paths but preservesmemory/andoutput/, which is exactly where this skill writes. - The guard also appends its own
## seo-audit (read-only)run-log line, so the log entry below is the detail under it, not a duplicate.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 397 lines · 56 tokens per session scan A dd43f312b6ce
seo-audit is a skill published in the GitHub repository aeonfun/aeon (716 stars, last pushed yesterday), licensed MIT. It adds 56 tokens to every session and 5,168 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
flowcraft-config
Author, validate, and troubleshoot complete FlowCraft deployment configuration (deploy.yaml with the runtime section, inference/workspace/sandbox/tool sub-documents, core/memory contracts, and graph JSON node wiring). Use when writing or reviewing FlowCraft configs, assembling an agent deployment, adding…
api-interface-design
Use when designing public APIs, module boundaries, provider adapters, tool schemas, or data contracts.
unit-converter
Converts values between metric and imperial units, using the project's agreed factors.
explore
Explore the codebase and summarize how the project is wired.
flow-define
Multi-AI requirements scoping using Codex and Gemini CLIs (Double Diamond Define phase). Use when: AUTOMATICALLY ACTIVATE when user requests clarification or scoping:. "define the requirements for X". "clarify the scope of Y".
flow-develop
Multi-AI implementation using Codex and Gemini CLIs (Double Diamond Develop phase). Use when: AUTOMATICALLY ACTIVATE when user requests building or implementation:. "build X" or "implement Y" or "create Z". "develop a feature for X".